MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf1b8188e4a025237264e670cf5eec1a56d6e5ef10ee837d325f642626f97fe7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	bf1b8188e4a025237264e670cf5eec1a56d6e5ef10ee837d325f642626f97fe7
SHA3-384 hash:	13b0d52817f6cb112b027d8ce7c26bdab7926dbbdd6ac2dca1c998b81031727f23cfcac81d242a77666432d78f7aa544
SHA1 hash:	952145e9c2b050da533c3c8e26fe421a9cf39955
MD5 hash:	9c06c392efc517da443b8e847ce752fd
humanhash:	violet-uniform-mike-item
File name:	file
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	4'811'336 bytes
First seen:	2026-02-03 23:04:24 UTC
Last seen:	2026-02-03 23:24:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	2357c925d5987053dcf0c59a30ebf2d4 (1 x Smoke Loader)
ssdeep	98304:kBXwY53vIMvUnh9bqnWkI/B5NJ2dIaZ7L/Foze7:kBAs3Ji+WhpXJ2dRZH/Fo0
TLSH	T15826DF2629ED60EAE87ADDF2A0E0B5C11F94FD7D45A508E468CC7678DC120533FAF819
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.6% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543 signed Smoke Loader

Code Signing Certificate

Organisation:	SiliconPulse_Production_AR
Issuer:	SiliconPulse_Production_AR
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-02-02T13:13:38Z
Valid to:	2028-02-03T13:13:38Z
Serial number:	21f26743da1ed190
Thumbprint Algorithm:	SHA256
Thumbprint:	397ea7491521c64ba786769f68c9d31e42e2938da9cda4e5debb431d4942f951
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Bitsight

url: http://130.12.180.43/files/8428202012/bIMApgG.exe

Intelligence

File Origin

# of uploads :

# of downloads :

168

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2026-02-03 23:06:32 UTC

Tags:

stealer

Link:

https://app.any.run/tasks/1262cd39-ffc9-458a-99e0-848522a9f542

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/51587/

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69827f366b1af47db72c948b

Tags:

injection obfusc crypt

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending an HTTP POST request

Sending a custom TCP request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

adaptive-context anti-debug installer-heuristic keylogger packed signed

Link:

https://www.filescan.io/uploads/69827f31930564ff3c880dda/reports/6a828c6a-7e8d-42fa-8095-48e69b6a89a2/overview

Verdict:

Malicious

Labled as:

Win64/GenKryptik.HNYE trojan

Link:

https://www.hybrid-analysis.com/sample/bf1b8188e4a025237264e670cf5eec1a56d6e5ef10ee837d325f642626f97fe7

Result

Gathering data

Verdict:

Clean

File Type:

exe x64

Link:

https://opentip.kaspersky.com/bf1b8188e4a025237264e670cf5eec1a56d6e5ef10ee837d325f642626f97fe7/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/555fe9b9-ab9a-44ad-849d-ffeae21ed346

Score:

46%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/bf1b8188e4a025237264e670cf5eec1a56d6e5ef10ee837d325f642626f97fe7

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bf1b8188e4a025237264e670cf5eec1a56d6e5ef10ee837d325f642626f97fe7/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/bf1b8188e4a025237264e670cf5eec1a56d6e5ef10ee837d325f642626f97fe7

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-02-03 23:05:29 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

5 of 36 (13.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x4nydcheuassg4te4zym6xxmdjlnnzppcdxig7jsl5scmjxzp7tq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/260203-221ebsdx4c/

Behaviour

Suspicious behavior: EnumeratesProcesses

Browser Information Discovery

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

bf1b8188e4a025237264e670cf5eec1a56d6e5ef10ee837d325f642626f97fe7

MD5 hash:

9c06c392efc517da443b8e847ce752fd

SHA1 hash:

952145e9c2b050da533c3c8e26fe421a9cf39955

Link:

https://www.unpac.me/results/1e51a355-6e50-4eef-a853-9027d99347e3/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bf1b8188e4a0/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.17

Link:

https://yomi.yoroi.company/submissions/bf1b8188e4a025237264e670cf5eec1a56d6e5ef10ee837d325f642626f97fe7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.